-
Notifications
You must be signed in to change notification settings - Fork 928
feat: implement OAuth2 dynamic client registration (RFC 7591/7592) #18645
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
3902793
to
b37d850
Compare
ff83df4
to
3665807
Compare
b37d850
to
caf974c
Compare
3665807
to
56126dd
Compare
caf974c
to
22b8b6d
Compare
56126dd
to
fca6b9a
Compare
14c7196
to
c43b551
Compare
fca6b9a
to
68baa21
Compare
46d50e8
to
61142ba
Compare
dd8ddee
to
54580fa
Compare
d40ab47
to
ac3723a
Compare
54580fa
to
21cdd55
Compare
ac3723a
to
d596e33
Compare
2410fd8
to
7eb343b
Compare
d596e33
to
826b305
Compare
+1 to this |
826b305
to
e119638
Compare
7eb343b
to
3760dd0
Compare
a8a29d4
to
f9e693d
Compare
Looking at the router/ Are you suggesting moving those handlers into a different package or moving the logic behind them into their own package, which then gets called from those API handlers? (I'm assuming the latter, but I want to be sure.) |
3760dd0
to
2a41a65
Compare
9629df1
to
df790c7
Compare
52c88e0
to
4799b4b
Compare
df790c7
to
17af791
Compare
a07ba99
to
5c1b9f6
Compare
17af791
to
3e15358
Compare
5c1b9f6
to
09c5055
Compare
3e15358
to
6bea7a6
Compare
… MCP compliance - Add comprehensive OAuth2 dynamic client registration support - Implement RFC 7591 client registration endpoint with proper validation - Implement RFC 7592 client management protocol (GET/PUT/DELETE) - Add RFC 6750 Bearer token authentication support - Fix authorization context issues with AsSystemRestricted - Add proper RBAC permissions for OAuth2 resources - Implement registration access token security per RFC 7592 - Add comprehensive validation for redirect URIs, grant types, response types - Support custom schemes for native applications - Add database migration with all RFC-required fields - Add audit logging support for OAuth2 operations - Ensure full RFC compliance with proper error handling - Add comprehensive test coverage for all scenarios Change-Id: I36c711201d598a117f6bfc381fc74e07fc3cc365 Signed-off-by: Thomas Kosiewski <[email protected]>
6bea7a6
to
e33d3d6
Compare
Implement OAuth2 Dynamic Client Registration (RFC 7591/7592)
This PR implements OAuth2 Dynamic Client Registration according to RFC 7591 and Client Configuration Management according to RFC 7592. These standards allow OAuth2 clients to register themselves programmatically with Coder as an authorization server.
Key changes include:
Added database schema extensions to support RFC 7591/7592 fields in the
oauth2_provider_apps
tableImplemented
/oauth2/register
endpoint for dynamic client registration (RFC 7591)Added client configuration management endpoints (RFC 7592):
/oauth2/clients/{client_id}
Added comprehensive validation for OAuth2 client metadata:
Enhanced developer documentation with:
The implementation follows security best practices from the RFCs, including proper token handling, secure defaults, and appropriate error responses. This enables third-party applications to integrate with Coder's OAuth2 provider capabilities programmatically.